Coverage › CVE-2024-54085

CVE-2024-54085 Mapped Partial Sigma

AMI MegaRAC SPx Authentication Bypass by Spoofing Vulnerability

Vendor / product: AMI — MegaRAC SPx
Description (CISA): AMI MegaRAC SPx contains an authentication bypass by spoofing vulnerability in the Redfish Host Interface. A successful exploitation of this vulnerability may lead to a loss of confidentiality, integrity, and/or availability.
Added to KEV: 2025-06-25
Due date: 2025-07-16
Required action: Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.
Known ransomware use: Unknown
CWE: CWE-290
CISA notes: This vulnerability could affect an open-source component, third-party library, protocol, or proprietary implementation that could be used by different products. For more information, please see: https://go.ami.com/hubfs/Security%20Advisories/2025/AMI-SA-2025003.pdf
https://security.netapp.com/advisory/ntap-20250328-0003/
https://nvd.nist.gov/vuln/detail/CVE-2024-54085
Elsewhere: cve.org · NVD · CISA KEV · JSON

ATT&CK techniques · CTID Mappings Explorer, ATT&CK 16.1, KEV snapshot 2025-07-28

5 mapping objects across 5 techniques. exploitation technique states how the vulnerability is exploited; primary and secondary impact state what exploitation achieves. They are different claims and are labelled as such.

Technique	Mapping type	CTID comment	Status in v19.2
T1068 Exploitation for Privilege Escalation	exploitation technique	By sending a malicious request to the Redfish Host Interface, an attacker can manipulate the HTTP header, tricking the Baseboard Management Controller (BMC) into thinking that the request originates from a trusted source, leading to authentication bypass. This can lead to complete system control, deployment of malware at the firmware level, and network disruptions. ref 1	live
T1210 Exploitation of Remote Services	primary impact	By sending a malicious request to the Redfish Host Interface, an attacker can manipulate the HTTP header, tricking the Baseboard Management Controller (BMC) into thinking that the request originates from a trusted source, leading to authentication bypass. This can lead to complete system control, deployment of malware at the firmware level, and network disruptions. ref 1	live
T1495 Firmware Corruption	primary impact	By sending a malicious request to the Redfish Host Interface, an attacker can manipulate the HTTP header, tricking the Baseboard Management Controller (BMC) into thinking that the request originates from a trusted source, leading to authentication bypass. This can lead to complete system control, deployment of malware at the firmware level, and network disruptions. ref 1	live
T1499 Endpoint Denial of Service	primary impact	By sending a malicious request to the Redfish Host Interface, an attacker can manipulate the HTTP header, tricking the Baseboard Management Controller (BMC) into thinking that the request originates from a trusted source, leading to authentication bypass. This can lead to complete system control, deployment of malware at the firmware level, and network disruptions. ref 1	live
T1608.001 Upload Malware	primary impact	By sending a malicious request to the Redfish Host Interface, an attacker can manipulate the HTTP header, tricking the Baseboard Management Controller (BMC) into thinking that the request originates from a trusted source, leading to authentication bypass. This can lead to complete system control, deployment of malware at the firmware level, and network disruptions. ref 1	live

Detection chain · ATT&CK Enterprise v19.2 detection strategies, analytics, log sources

T1068 Exploitation for Privilege Escalation exploitation technique

DET0514 Detection Strategy for Exploitation for Privilege Escalation
AN1419 Windows
Detects exploitation attempts targeting vulnerable kernel drivers or OS components, often followed by unusual process or token behavior.

WinEventLog:Sysmon EventCode=6 → DC0079 Driver Load
WinEventLog:Sysmon EventCode=1 → DC0032 Process Creation
WinEventLog:Security EventCode=4672 → DC0088 Logon Session Metadata

Tunable: DriverNamePattern TimeWindow ParentProcessPath

AN1420 Linux
Detects escalation via vulnerable setuid binaries or kernel modules, often chained with unusual access to /proc/kallsyms or /dev/kmem.

auditd:SYSCALL execve → DC0032 Process Creation
auditd:SYSCALL ACCESS → DC0035 Process Access
auditd:SYSCALL dmesg → DC0016 Module Load

Tunable: SetUIDBinaryList TimeWindow EffectiveUIDThreshold

AN1421 macOS
Detects use of vulnerable kernel extensions or entitlements abused via setuid or AppleScript injection chains.

macos:unifiedlog process:exec and kext load events → DC0032 Process Creation
macos:endpointsecurity ES_EVENT_TYPE_NOTIFY_KEXTLOAD → DC0016 Module Load

Tunable: EntitlementList TimeWindow

AN1422 Containers
Detects container breakout behavior via exploitation (e.g., DirtyPipe, CVE-2022-0847), followed by host OS interaction or escalated capability assignment.

auditd:SYSCALL capset or setns → DC0067 Logon Session Creation
containerd:runtime e.g., containerd, Docker events → DC0091 Container Enumeration

Tunable: NamespaceEscapePattern TimeWindow

Sigma rules tagged `attack.t1068` (31)

Exploiting CVE-2019-1388 criticalstable

Author: Florian Roth (Nextron Systems) · 2019-11-20 (modified 2024-12-01) · logsource: product=windows category=process_creation · 02e0b2ea-a597-428e-b04a-af6a1a403e5c

Detects an exploitation attempt in which the UAC consent dialogue is used to invoke an Internet Explorer process running as LOCAL_SYSTEM

Techniques: T1068

CVE tags: CVE-2019-1388

Malicious Driver Load hightest

Author: Nasreddine Bencherchali (Nextron Systems) · 2022-08-18 (modified 2023-12-02) · logsource: product=windows category=driver_load · 05296024-fe8a-4baf-8f3d-9a5f5624ceb2

Detects loading of known malicious drivers via their hash.

Techniques: T1543.003 T1068

Possible Coin Miner CPU Priority Param criticaltest

Author: Florian Roth (Nextron Systems) · 2021-10-09 (modified 2022-12-25) · logsource: product=linux service=auditd · 071d5e5a-9cef-47ec-bc4e-a42e34d8d0ed

Detects command line parameter very often used with coin miners

Techniques: T1068

Potential Exploitation of CrushFTP RCE Vulnerability (CVE-2025-54309) highexperimental

Author: Nisarg Suthar · 2025-08-01 · logsource: product=windows category=process_creation · 0fdc7c7f-c690-4217-9ae3-31f5156eed72

Detects suspicious child processes created by CrushFTP. It could be an indication of exploitation of a RCE vulnerability such as CVE-2025-54309.

Techniques: T1059.001 T1059.003 T1068 T1190

CVE tags: CVE-2025-54309

Non-Standard Nsswitch.Conf Creation - Potential CVE-2025-32463 Exploitation highexperimental

Author: Swachchhanda Shrawn Poudel (Nextron Systems) · 2025-10-02 (modified 2026-03-31) · logsource: product=linux category=file_event · 10ac0730-c24e-4f4c-81f8-b13a1ac95a1d

Detects the creation of nsswitch.conf files in non-standard directories, which may indicate exploitation of CVE-2025-32463. This vulnerability requires an attacker to create a nsswitch.conf in a directory that will be used during sudo chroot operations. When sudo executes, it loads malicious shared libraries from user-controlled locations within the chroot environment, potentially leading to arbitrary code execution and privilege escalation.

Techniques: T1068

CVE tags: CVE-2025-32463

Potential CVE-2024-35250 Exploitation Activity mediumexperimental

Author: @eyezuhk Isaac Fernandes · 2025-02-19 · logsource: product=windows category=image_load · 17ce9373-2163-4a2c-90ba-f91e9ef7a8c1

Detects potentially suspicious loading of "ksproxy.ax", which may indicate an attempt to exploit CVE-2024-35250.

Techniques: T1068

CVE tags: CVE-2024-35250

Buffer Overflow Attempts hightest

Author: Florian Roth (Nextron Systems) · 2017-03-01 (modified 2025-03-17) · logsource: product=linux · 18b042f0-2ecd-4b6e-9f8d-aa7a7e7de781

Detects buffer overflow attempts in Unix system log files

Techniques: T1068

Exploiting SetupComplete.cmd CVE-2019-1378 hightest

Author: Florian Roth (Nextron Systems), oscd.community, Jonhnathan Ribeiro · 2019-11-15 (modified 2021-11-27) · logsource: product=windows category=process_creation · 1c373b6d-76ce-4553-997d-8c1da9a6b5f5

Detects exploitation attempt of privilege escalation vulnerability via SetupComplete.cmd and PartnerSetupComplete.cmd described in CVE-2019-1378

Techniques: T1068 T1059.003 T1574

CVE tags: CVE-2019-1378

OMIGOD SCX RunAsProvider ExecuteShellCommand hightest

Author: Roberto Rodriguez (Cyb3rWard0g), OTR (Open Threat Research), MSTIC · 2021-10-15 (modified 2022-10-05) · logsource: product=linux category=process_creation · 21541900-27a9-4454-9c4c-3f0a4240344a

Rule to detect the use of the SCX RunAsProvider Invoke_ExecuteShellCommand to execute any UNIX/Linux command using the /bin/sh shell. SCXcore, started as the Microsoft Operations Manager UNIX/Linux Agent, is now used in a host of products including Microsoft Operations Manager, Microsoft Azure, and Microsoft Operations Management Suite.

Techniques: T1068 T1190 T1203

HKTL - SharpSuccessor Privilege Escalation Tool Execution highexperimental

Author: Swachchhanda Shrawan Poudel (Nextron Systems) · 2025-06-06 · logsource: product=windows category=process_creation · 38a1ac5f-9c74-47d2-a345-dd6f5eb4e7c8

Detects the execution of SharpSuccessor, a tool used to exploit the BadSuccessor attack for privilege escalation in WinServer 2025 Active Directory environments. Successful usage of this tool can let the attackers gain the domain admin privileges by exploiting the BadSuccessor vulnerability.

Techniques: T1068

Malicious Driver Load By Name mediumtest

Author: Nasreddine Bencherchali (Nextron Systems) · 2022-10-03 (modified 2023-12-02) · logsource: product=windows category=driver_load · 39b64854-5497-4b57-a448-40977b8c9679

Detects loading of known malicious drivers via the file name of the drivers.

Techniques: T1543.003 T1068

InstallerFileTakeOver LPE CVE-2021-41379 File Create Event criticaltest

Author: Florian Roth (Nextron Systems) · 2021-11-22 (modified 2022-12-25) · logsource: product=windows category=file_event · 3be82d5d-09fe-4d6a-a275-0d40d234d324

Detects signs of the exploitation of LPE CVE-2021-41379 that include an msiexec process that creates an elevation_service.exe file

Techniques: T1068

Linux AF_ALG Socket Creation - Kernel Crypto API Exploit Indicator highexperimental

Author: Gene Kazimiarovich · 2026-04-30 · logsource: product=linux service=auditd · 474b415a-8b3d-4e6a-9f12-0d5c8a7b6e94

Detects creation of AF_ALG (Address Family 38) sockets via the socket() syscall. AF_ALG is the Linux kernel crypto API interface. It is exploited in CVE-2026-31431 to achieve local privilege escalation via a buffer overflow in the AF_ALG AEAD splice path that corrupts the page cache of SUID binaries. Legitimate AF_ALG usage is rare and confined to specific crypto utilities and VPN daemons using non-default kernel offload configurations.

Techniques: T1068

CVE tags: CVE-2026-31431

Authencesn Crypto Module Load via Modprobe - Copy-Fail Indicator highexperimental

Author: Gene Kazimiarovich · 2026-05-09 · logsource: product=linux category=process_creation · 474b415a-d917-4f3b-8c62-9e1a0d5f7b48

Detects kernel auto-loading of the authencesn crypto module via modprobe This occurs when user-space code creates an AF_ALG socket and binds the authencesn AEAD cipher (e.g., authencesn(hmac(sha256),cbc(aes))). The kernel invokes modprobe to load the crypto module. This is a key indicator of CVE-2026-31431 (Copy Fail) exploitation, where the authencesn cipher is used to trigger a buffer overflow in the AF_ALG AEAD splice path, corrupting the page cache of SUID binaries for local privilege escalation. On Linux systems, modprobe is typically a symlink to kmod, so the process image will be /usr/bin/kmod (or /bin/kmod) with 'modprobe' appearing in the command line.

Techniques: T1068 T1547.006

CVE tags: CVE-2026-31431

Audit CVE Event criticaltest

Author: Florian Roth (Nextron Systems), Zach Mathis · 2020-01-15 (modified 2022-10-22) · logsource: product=windows service=application · 48d91a3a-2363-43ba-a456-ca71ac3da5c2

Detects events generated by user-mode applications when they call the CveEventWrite API when a known vulnerability is trying to be exploited. MS started using this log in Jan. 2020 with CVE-2020-0601 (a Windows CryptoAPI vulnerability. Unfortunately, that is about the only instance of CVEs being written to this log.

Techniques: T1203 T1068 T1211 T1212 T1210 T1499.004

All 31 rules on the technique page →

T1210 Exploitation of Remote Services primary impact

DET0118 Exploitation of Remote Services – multi-platform lateral movement detection
AN0327 Windows
Correlates inbound network access to remote service ports (e.g., SMB/RPC 445/135, RDP 3389, WinRM 5985/5986) with near-time instability in the target service (crash, abnormal restart), suspicious child process creation under the service, and post-access lateral-movement behaviors. The chain indicates likely exploitation rather than normal administration.

WinEventLog:System EventCode=1000 → DC0038 Application Log Content
WinEventLog:Sysmon EventCode=1 → DC0032 Process Creation
WinEventLog:Sysmon EventCode=3, 22 → DC0082 Network Connection Creation
WinEventLog:Sysmon EventCode=7 → DC0016 Module Load
WinEventLog:Sysmon EventCode=10 → DC0035 Process Access
WinEventLog:Sysmon EventCode=11 → DC0039 File Creation
NSM:Flow Inbound connections to 445, 3389, 5985-5986 with high error/connection-reset rate, followed by new outbound sessions from the same host to internal assets within short interval. → DC0085 Network Traffic Content

Tunable: ServicePortSet TimeWindow AllowedAdminCIDRs MinConnErrorRate

AN0328 Linux
Links inbound network access to SSHD/SMB/NFS/Databases or custom daemons with subsequent daemon crash/restart, core dump, or spawning of shells/reverse shells from the service context, indicating remote exploitation.

linux:syslog kernel|systemd messages indicating 'segmentation fault'|'core dumped'|'service terminated unexpectedly' for sshd, smbd, vsftpd, mysqld, httpd, etc. → DC0038 Application Log Content
auditd:SYSCALL execve of /bin/sh,/bin/bash,/usr/bin/curl,/usr/bin/python by service accounts (e.g., apache, mysql, nobody) immediately after inbound network activity. → DC0032 Process Creation
NSM:Flow Inbound connections to monitored service ports from external or unusual internal sources; rapid follow-on lateral connections from the same host. → DC0085 Network Traffic Content

Tunable: ServiceNames CoreDumpPaths ShellSpawnAllowlist TimeWindow

AN0329 ESXi
Detects exploitation targeting ESXi/vCenter by correlating attempts to reach known exploitable endpoints (OpenSLP 427, CIM 5989, Hostd/Vpxa HTTPS 443, ESXi SOAP) with vmkernel/hostd crashes, unexpected hostd/vpxa restarts, or new reverse/outbound connections from ESXi host/vCenter to internal assets.

esxi:hostd Keywords: 'Backtrace','Signal 11','PANIC','hostd restarted','assert' or 'Service terminated unexpectedly' in /var/log/hostd.log, /var/log/vmkernel.log, /var/log/syslog.log. → DC0038 Application Log Content
NSM:Flow Inbound to tcp/427 (OpenSLP), tcp/443 (vSphere APIs), tcp/902, tcp/5989 followed by new unexpected outbound sessions from the ESXi/vCenter host. → DC0085 Network Traffic Content

Tunable: ESXiServicePorts MgmtCIDRs RestartKeywords

AN0330 macOS
Ties inbound access to exposed services (ARD/VNC 5900, SSH 22, ScreenSharing, web services) with process crashes in unified logs and abnormal child processes spawned under those services (e.g., bash, curl) to indicate exploitation.

macos:unifiedlog process 'crashed'|'EXC_BAD_ACCESS' for sshd, screensharingd, httpd; launchd restarts of these daemons. → DC0038 Application Log Content
macos:osquery parent_name in ('sshd','httpd','screensharingd') spawning shells or scripting runtimes. → DC0032 Process Creation
NSM:Flow Inbound to 22/5900/8080 and follow-on internal connections. → DC0085 Network Traffic Content

Tunable: ServicePortSet AllowedAdmins TimeWindow

Sigma rules tagged `attack.t1210` (15)

Potential CVE-2023-46214 Exploitation Attempt mediumtest

Author: Nasreddine Bencherchali (Nextron Systems), Bhavin Patel (STRT) · 2023-11-27 · logsource: category=webserver · 04017cd5-621e-4ec4-a762-1f042fe3d3e5

Detects potential exploitation of CVE-2023-46214, a remote code execution (RCE) in Splunk Enterprise through insecure XML parsing

Techniques: T1210

CVE tags: CVE-2023-46214

Terminal Service Process Spawn hightest

Author: Florian Roth (Nextron Systems) · 2019-05-22 (modified 2023-01-25) · logsource: product=windows category=process_creation · 1012f107-b8f1-4271-af30-5aed2de89b39

Detects a process spawned by the terminal service server process (this could be an indicator for an exploitation of CVE-2019-0708)

Techniques: T1190 T1210

Zerologon Exploitation Using Well-known Tools criticalstable

Author: Demyan Sokolin @_drd0c, Teymur Kheirkhabarov @HeirhabarovT, oscd.community · 2020-10-13 (modified 2021-05-30) · logsource: product=windows service=system · 18f37338-b9bd-4117-a039-280c81f7a596

This rule is designed to detect attempts to exploit Zerologon (CVE-2020-1472) vulnerability using mimikatz zerologon module or other exploits from machine with "kali" hostname.

Techniques: T1210

WannaCry Ransomware Activity criticaltest

Author: Florian Roth (Nextron Systems), Tom U. @c_APT_ure (collection), oscd.community, Jonhnathan Ribeiro · 2019-01-16 (modified 2025-10-18) · logsource: product=windows category=process_creation · 41d40bff-377a-43e2-8e1b-2e543069e079

Detects WannaCry ransomware activity

Techniques: T1210 T1083 T1222.001 T1486 T1490

Audit CVE Event criticaltest

Author: Florian Roth (Nextron Systems), Zach Mathis · 2020-01-15 (modified 2022-10-22) · logsource: product=windows service=application · 48d91a3a-2363-43ba-a456-ca71ac3da5c2

Techniques: T1203 T1068 T1211 T1212 T1210 T1499.004

Suspicious SysAidServer Child mediumtest

Author: Florian Roth (Nextron Systems) · 2022-08-26 · logsource: product=windows category=process_creation · 60bfeac3-0d35-4302-8efb-1dd16f715bc6

Detects suspicious child processes of SysAidServer (as seen in MERCURY threat actor intrusions)

Techniques: T1210

Scanner PoC for CVE-2019-0708 RDP RCE Vuln hightest

Author: Florian Roth (Nextron Systems), Adam Bradbury (idea) · 2019-06-02 (modified 2022-12-25) · logsource: product=windows service=security · 8400629e-79a9-4737-b387-5db940ab2367

Detects the use of a scanner by zerosum0x0 that discovers targets vulnerable to CVE-2019-0708 RDP RCE aka BlueKeep

Techniques: T1210

CVE tags: CVE-2019-0708

DNS Query Request By QuickAssist.EXE lowexperimental

Author: Muhammad Faisal (@faisalusuf) · 2024-12-19 · logsource: product=windows category=dns_query · 882e858a-3233-4ba8-855e-2f3d3575803d

Detects DNS queries initiated by "QuickAssist.exe" to Microsoft Quick Assist primary endpoint that is used to establish a session.

Techniques: T1071.001 T1210

Potential RDP Exploit CVE-2019-0708 mediumtest

Author: Lionel PRAT, Christophe BROCAS, @atc_project (improvements) · 2019-05-24 (modified 2022-12-25) · logsource: product=windows service=system · aaa5b30d-f418-420b-83a0-299cb6024885

Detect suspicious error on protocol RDP, potential CVE-2019-0708

Techniques: T1210

CVE tags: CVE-2019-0708

OMIGOD HTTP No Authentication RCE - CVE-2021-38647 highstable

Author: Nate Guagenti (neu5ron) · 2021-09-20 (modified 2025-11-03) · logsource: product=zeek service=http · ab6b1a39-a9ee-4ab4-b075-e83acf6e346b

Detects the exploitation of OMIGOD (CVE-2021-38647) which allows remote execute (RCE) commands as root with just a single unauthenticated HTTP request. Verify, successful, exploitation by viewing the HTTP client (request) body to see what was passed to the server (using PCAP). Within the client body is where the code execution would occur. Additionally, check the endpoint logs to see if suspicious commands or activity occurred within the timeframe of this HTTP request.

Techniques: T1068 T1190 T1203 T1021.006 T1210

CVE tags: CVE-2021-38647

HackTool - SharpWSUS/WSUSpendu Execution hightest

Author: @Kostastsale, Nasreddine Bencherchali (Nextron Systems) · 2022-10-07 (modified 2024-08-23) · logsource: product=windows category=process_creation · b0ce780f-10bd-496d-9067-066d23dc3aa5

Detects the execution of SharpWSUS or WSUSpendu, utilities that allow for lateral movement through WSUS. Windows Server Update Services (WSUS) is a critical component of Windows systems and is frequently configured in a way that allows an attacker to circumvent internal networking limitations.

Techniques: T1210

Exploitation Attempt Of CVE-2023-46214 Using Public POC Code hightest

Author: Lars B. P. Frydenskov(Trifork Security) · 2023-11-27 · logsource: category=webserver · ba5268de-4dd4-4d5c-8a90-2b5e6dc1aff8

Detects exploitation attempt of CVE-2023-46214, a remote code execution (RCE) in Splunk Enterprise through insecure XML parsing using known public proof of concept code

Techniques: T1210

CVE tags: CVE-2023-46214

Possible Exploitation of Exchange RCE CVE-2021-42321 hightest

Author: Florian Roth (Nextron Systems), @testanull · 2021-11-18 (modified 2022-07-12) · logsource: product=windows service=msexchange-management · c92f1896-d1d2-43c3-92d5-7a5b35c217bb

Detects log entries that appear in exploitation attempts against MS Exchange RCE CVE-2021-42321

Techniques: T1210

Exploitation Attempt Of CVE-2020-1472 - Execution of ZeroLogon PoC hightest

Author: @Kostastsale, TheDFIRReport · 2022-02-12 · logsource: product=windows category=process_creation · dcc6a01e-9471-44a0-a699-71ea96f8ed8b

Detects the execution of the commonly used ZeroLogon PoC executable.

Techniques: T1210

CVE tags: CVE-2020-1472

Apache Threading Error mediumtest

Author: Florian Roth (Nextron Systems) · 2019-01-22 (modified 2021-11-27) · logsource: service=apache · e9a2b582-3f6a-48ac-b4a1-6849cdc50b3c

Detects an issue in apache logs that reports threading related errors

Techniques: T1190 T1210

T1495 Firmware Corruption primary impact

DET0167 Firmware Modification via Flash Tool or Corrupted Firmware Upload
AN0474 Windows
Firmware flash utility invoked with elevated privileges followed by raw access to firmware device path or changes to boot configuration.

WinEventLog:Security EventCode=4688 → DC0032 Process Creation
WinEventLog:Sysmon EventCode=6 → DC0079 Driver Load
WinEventLog:Microsoft-Windows-Kernel-Boot Firmware integrity validation failed or boot configuration tampered → DC0004 Firmware Modification

Tunable: ParentImage CommandLine

AN0475 Linux
Direct write access to /dev/mem or /sys/firmware combined with usage of firmware flashing utilities (e.g., flashrom).

auditd:SYSCALL write access to /dev/mem or /sys/firmware/efi/efivars → DC0004 Firmware Modification
auditd:SYSCALL execution of known flash tools (e.g., flashrom, fwupd) → DC0032 Process Creation

Tunable: ToolName

AN0476 macOS
EFI updates executed via system processes or binaries outside of expected patch windows or using unsigned firmware packages.

macos:unifiedlog com.apple.firmwareupdater activity or update-firmware binary invoked → DC0032 Process Creation
macos:unifiedlog boot failure events or SMC validation errors → DC0004 Firmware Modification

Tunable: UpdateTimeWindow

AN0477 Network Devices
Firmware image uploaded via TFTP/SCP or web interface followed by reboot or unexpected loss of connectivity.

NSM:Flow large upload to firmware interface port or path → DC0085 Network Traffic Content
networkdevice:firmware Firmware update initiated or bootloader tampering detected → DC0004 Firmware Modification

Tunable: UploadSizeThreshold RebootWindow

Sigma rules tagged `attack.t1495` (1)

Cisco Denial of Service mediumtest

Author: Austin Clark · 2019-08-15 (modified 2023-01-04) · logsource: product=cisco service=aaa · d94a35f0-7a29-45f6-90a0-80df6159967c

Detect a system being shutdown or put into different boot mode

Techniques: T1495 T1529 T1565.001

T1499 Endpoint Denial of Service primary impact

DET0208 Endpoint Resource Saturation and Crash Pattern Detection Across Platforms
AN0584 Windows
Excessive resource exhaustion or service crash induced by processes launched by users or scripts that rapidly consume CPU/memory or attempt malformed service interactions.

WinEventLog:Sysmon EventCode=1 → DC0032 Process Creation
WinEventLog:Application Service crash, unhandled exception, or application hang warnings for critical services (e.g., IIS, DNS, SQL Server) → DC0038 Application Log Content
WinEventLog:System System shutdowns due to bugcheck (Event ID 1001) or watchdog timer expirations → DC0018 Host Status

Tunable: TimeWindow ServiceTarget CPUThresholdPercent

AN0585 Linux
Malicious script or binary causes repeated kernel panics, OOM kills, or systemd service restarts targeting services like nginx, httpd, sshd.

auditd:SYSCALL execve → DC0032 Process Creation
linux:syslog Out of memory killer invoked or kernel panic entries → DC0018 Host Status
journald:systemd Repeated service restart attempts or unit failures → DC0038 Application Log Content

Tunable: ServiceName RestartThreshold OOMKillCount

AN0586 macOS
Adversary launches high-entropy process or malformed app bundle causing repeated application crashes and system slowdowns.

macos:unifiedlog Repeated process crashes logged by CrashReporter or system instability logs in com.apple.console → DC0038 Application Log Content
macos:unifiedlog Spike in CPU or memory use from non-user-initiated processes → DC0018 Host Status

Tunable: CrashCountThreshold PayloadEntropyThreshold

AN0587 IaaS
Instance enters degraded/unhealthy state due to abnormal process load or memory exhaustion, often caused by automation or script-based attacks.

AWS:CloudWatch StatusCheckFailed or StatusCheckFailed_System for burstable instances (t2/t3) → DC0018 Host Status
AWS:CloudTrail StartInstances → DC0080 Instance Start
VPCFlowLogs:All High volume internal traffic with low entropy indicating looped or malicious DoS script → DC0078 Network Traffic Flow

Tunable: InstanceType FailureThreshold

AN0588 Containers
Container orchestrator logs show crashlooping pods, repeated resource exhaustion, or malicious binaries with infinite loops consuming systemd/cgroup limits.

kubernetes:events CrashLoopBackOff, OOMKilled, container restart count exceeds threshold → DC0018 Host Status
docker:events Container exited with non-zero code repeatedly in short period → DC0038 Application Log Content

Tunable: RestartCountThreshold ContainerImageEntropy

Sigma rules tagged `attack.t1499` (3)

CVE-2024-49113 Exploitation Attempt - LDAP Nightmare highexperimental

Author: Samuel Monsempes · 2025-01-08 · logsource: product=windows service=application · 3f2c93c7-7b2a-4d58-bb8d-6f39422d8148

Detects exploitation attempt of CVE-2024-49113 known as LDAP Nightmare, based on "Application Error" log where the faulting application is "lsass.exe" and the faulting module is "WLDAP32.dll".

Techniques: T1499

CVE tags: CVE-2024-49113

Potential Abuse of Linux Magic System Request Key mediumexperimental

Author: Milad Cheraghi · 2025-05-23 · logsource: product=linux service=auditd · ea61bb82-a5e0-42e6-8537-91d29500f1b9

Detects the potential abuse of the Linux Magic SysRq (System Request) key by adversaries with root or sufficient privileges to silently manipulate or destabilize a system. By writing to /proc/sysrq-trigger, they can crash the system, kill processes, or disrupt forensic analysis—all while bypassing standard logging. Though intended for recovery and debugging, SysRq can be misused as a stealthy post-exploitation tool. It is controlled via /proc/sys/kernel/sysrq or permanently through /etc/sysctl.conf.

Techniques: T1059.004 T1529 T1489 T1499

LSASS Crash Via Netlogon Stack Buffer Overflow - CVE-2026-41089 highexperimental

Author: Swachchhanda Shrawan Poudel (Nextron Systems) · 2026-06-02 · logsource: product=windows service=application · f8a66a02-4a16-46e5-b7fd-a42c8a93d137

Detects a crash of the LSASS process where netlogon.dll is the faulting module and the exception code is STATUS_STACK_BUFFER_OVERRUN (0xc0000409). This crash, especially on Domain Controllers, might indicate the exploitation of CVE-2026-41089, a denial of service (DoS) vulnerability, which exists in the Netlogon component of Windows and can be triggered by sending specially crafted requests to the Netlogon service, leading to a stack-based buffer overflow and subsequent crash of the LSASS process.

Techniques: T1499

CVE tags: CVE-2026-41089

T1608.001 Upload Malware primary impact

DET0824 Detection of Upload Malware
AN1956 PRE
If infrastructure or patterns in malware have been previously identified, internet scanning may uncover when an adversary has staged malware to make it accessible for targeting. Much of this activity will take place outside the visibility of the target organization, making detection of this behavior difficult. Detection efforts may be focused on post-compromise phases of the adversary lifecycle, such as User Execution or Ingress Tool Transfer .

Internet Scan None → DC0104 Response Content

Sigma rules tagged `attack.t1608.001` (0)

None. MITRE's strategy above is the only public detection guidance for this technique.

CVE-2024-54085 Mapped Partial Sigma

ATT&CK techniques · CTID Mappings Explorer, ATT&CK 16.1, KEV snapshot 2025-07-28

Detection chain · ATT&CK Enterprise v19.2 detection strategies, analytics, log sources

T1068 Exploitation for Privilege Escalation exploitation technique

Sigma rules tagged attack.t1068 (31)

T1210 Exploitation of Remote Services primary impact

Sigma rules tagged attack.t1210 (15)

T1495 Firmware Corruption primary impact

Sigma rules tagged attack.t1495 (1)

T1499 Endpoint Denial of Service primary impact

Sigma rules tagged attack.t1499 (3)

T1608.001 Upload Malware primary impact

Sigma rules tagged attack.t1608.001 (0)

Sigma rules tagged `attack.t1068` (31)

Sigma rules tagged `attack.t1210` (15)

Sigma rules tagged `attack.t1495` (1)

Sigma rules tagged `attack.t1499` (3)

Sigma rules tagged `attack.t1608.001` (0)